Browse public community intelligence reports, source analysis, and threat research.
158 intel reports
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
An SEO poisoning campaign utilizes fake Chocolatey and Microsoft Activation Scripts websites to deliver Armorsteal, a modular Python-based stealer and remote access tool.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
Mustang Panda and other Chinese APTs utilize the PlugX RAT for espionage and credential theft, leveraging DLL side-loading and USB propagation.
